CISA hat am 03.11.2021 bestätigt, dass diese Schwachstelle in echten Angriffen genutzt wird. Frist für US-Bundesbehörden: 03.05.2022.
Erforderliche Maßnahme: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-11539
In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before 5.1R15.1, the admin web interface allows an authenticated attacker to inject and execute commands.
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| ivanti | connect secure | 8.1 | |
| ivanti | policy secure | 9.0 | |
| pulsesecure | pulse policy secure | 5.1r1.0 |
cpe:2.3:a:ivanti:connect_secure:8.1:-:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r1.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r1.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r10.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r11.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r11.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r12.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r12.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r13.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r14.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r2.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r2.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r3.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r3.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r3.2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r4.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r4.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r5.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r6.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r7:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r7.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r8.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r9.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r9.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.1:r9.2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:*:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r1.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r1.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r10.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r11.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r12.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r2.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r3.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r3.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r4.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r4.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r5.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r5.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r6.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r7.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r7.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r7.2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r8.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r8.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r8.2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.2:r9.0:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:-:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r1.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r2.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r3:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r4:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r5:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r5.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r5.2:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r6:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r6.1:*:*:*:*:*:*cpe:2.3:a:ivanti:connect_secure:8.3:r7:*:*:*:*:*:*Unser kostenloser Open-Source-Honeypot wartet auf Ports, die Ihr Server nicht nutzt, und meldet verbindende Scanner und Angreifer an eine gemeinsame Blockliste.